SaaS-Based Compliance Tools for IAs — What the Data Localisation Rules Require
Adopting cloud-based software has become second nature for most Investment Adviser practices — a CRM here, a portfolio-tracking tool there, a document management platform holding client KYC records. What's less second nature, and considerably more consequential, is the specific compliance undertaking SEBI now expects around exactly where that data sits and who can reach it.
Where This Requirement Comes From
SEBI's Master Circular framework for regulated entities includes a specific item requiring an undertaking on compliance with the advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions, to be submitted on a half-yearly basis. This traces back to a broader advisory — echoing similar guidance from CERT-In and financial sector regulators generally — around the risks of adopting cloud-based, third-party-hosted software without adequate diligence on data residency, access controls, and vendor security posture.
Why This Sits Alongside, Not Instead Of, CSCRF Compliance
Our companion article covers SEBI's Cybersecurity and Cyber Resilience Framework in detail. The SaaS-specific advisory is a related but distinct compliance thread — CSCRF addresses an entity's overall cybersecurity posture and resilience broadly, while the SaaS advisory targets a more specific risk: that third-party cloud platforms, particularly those hosted or operated outside India, can introduce data residency, access, and jurisdictional risks that a general cybersecurity policy doesn't automatically address. An IA needs both pieces addressed, not one in place of the other.
What "Data Localisation" Actually Means in This Context
The underlying concern is straightforward: where client financial data — KYC records, portfolio holdings, advisory communications — is physically stored, and which jurisdiction's laws and government access provisions apply to that data, matters for an Indian financial sector organisation independent of how secure the platform's technical safeguards otherwise are. A SaaS platform hosting Indian client data on servers outside India, subject to a foreign jurisdiction's legal access framework, raises questions the advisory is specifically meant to have entities confront and document, rather than leave unexamined simply because the platform's marketing emphasises its security certifications.
What the Half-Yearly Undertaking Actually Requires From an IA
Practically, this means an IA needs to maintain an inventory of every SaaS tool used in its operations that touches client data, assess each against the advisory's expectations (data residency, vendor access controls, contractual data protection commitments), and be able to produce a documented undertaking twice a year confirming this review has actually been done — not merely asserting compliance in the abstract without an underlying, maintained record supporting it.
Where This Overlaps With DPDPA Obligations
This SaaS-specific compliance thread sits alongside, and reinforces, an IA's broader obligations under the Digital Personal Data Protection Act, 2023 as a Data Fiduciary for client personal data — a SaaS vendor's data handling practices are relevant to both frameworks simultaneously, and a vendor agreement reviewed for DPDPA adequacy should be checked against the SEBI SaaS advisory's specific expectations at the same time, rather than as two separate exercises.
Practical Vendor Diligence Questions Worth Building Into Onboarding
Before adopting any new SaaS tool that will touch client data, an IA practice should be asking, and documenting the answers to: where is the data physically hosted, does the vendor's contract specify data residency commitments, what access controls exist around who at the vendor (or its own sub-processors) can reach the data, and what happens to the data if the vendor relationship ends. These questions belong in a standard vendor-onboarding checklist, not handled ad hoc each time a new tool is adopted.
Why Smaller Practices Shouldn't Assume This Doesn't Apply to Them
As with CSCRF, there's a common assumption that data localisation and SaaS-advisory compliance is really a large-institution concern. The half-yearly undertaking requirement applies across SEBI's regulated entities generally, and a smaller IA practice using the same category of consumer-grade CRM or document tools that a larger firm might use faces the same underlying question about that tool's data residency and access practices — scale doesn't change the nature of the risk, even if it changes the resources available to address it.
Building This Into a Repeatable, Documented Process
Given the half-yearly cadence of the undertaking, this isn't a one-time compliance exercise — it needs a maintained SaaS tool inventory, a periodic re-review process (particularly whenever a vendor changes its own infrastructure or terms), and a clear internal owner responsible for compiling and submitting the undertaking each cycle.
How We Help
We help Investment Advisers build the SaaS vendor inventory, diligence checklist, and half-yearly undertaking documentation this advisory requires — reviewing existing vendor contracts for data residency and access-control gaps, and setting up a repeatable process so this doesn't become a scramble every six months. If your practice hasn't mapped its SaaS tools against this specific requirement, our SEBI Intermediary Compliance practice can help you build that documentation properly.
This article is for general informational purposes and reflects the regulatory position as understood at the time of writing. It does not constitute regulatory advice specific to any IA's circumstances — please consult our team and verify the current SaaS advisory requirements directly with SEBI before relying on this for compliance planning.